# Updated Business Rules - Profile Update Requests

## ✅ Changes Made

### 1. Vendor Can Create Multiple Pending Requests
**Before:** Vendor could only have ONE pending request at a time
**After:** Vendor can create multiple pending requests

**Reason:** Allows vendor to submit multiple update requests (e.g., one for logo, another for location) without waiting for approval.

### 2. Admin Cannot Delete Pending Requests
**Before:** Admin could delete any request
**After:** Admin can only delete approved or rejected requests

**Reason:** Prevents accidental deletion of pending requests. Admin must approve or reject first.

---

## 📋 Updated Rules Summary

### Vendor Rules

| Action | Rule | Status |
|--------|------|--------|
| Create Request | Can create anytime | ✅ No restrictions |
| View Requests | Can view own requests only | ✅ Unchanged |
| Delete Request | Can delete own pending requests | ✅ Unchanged |
| Delete Request | Cannot delete approved/rejected | ✅ Unchanged |

### Admin Rules

| Action | Rule | Status |
|--------|------|--------|
| View Requests | Can view all requests | ✅ Unchanged |
| Approve Request | Can approve pending requests | ✅ Unchanged |
| Reject Request | Can reject pending requests | ✅ Unchanged |
| Delete Request | **Cannot delete pending requests** | ⚠️ **NEW** |
| Delete Request | Can delete approved/rejected | ✅ Unchanged |

---

## 🔄 Workflow Examples

### Example 1: Vendor Creates Multiple Requests

```
Day 1:
- Vendor uploads new logo
- Vendor creates Request #1 (logo update)
- Status: Pending

Day 2:
- Vendor uploads new commercial register
- Vendor creates Request #2 (commercial register update)
- Status: Pending

Result: Both requests exist and are pending
```

### Example 2: Admin Tries to Delete Pending Request

```
Admin views Request #1 (Status: Pending)
Admin clicks Delete
❌ Error: "Cannot delete pending requests. Please approve or reject first."

Admin must:
1. Approve or Reject the request first
2. Then delete if needed
```

### Example 3: Admin Deletes Approved Request

```
Admin views Request #1 (Status: Approved)
Admin clicks Delete
✅ Success: "Profile update request deleted successfully."
```

---

## 🎯 Use Cases

### Use Case 1: Vendor Needs to Update Multiple Things
**Scenario:** Vendor wants to update logo, commercial register, and location

**Before:**
1. Create request for logo → Wait for approval
2. After approval, create request for commercial register → Wait
3. After approval, create request for location → Wait

**After:**
1. Create request for logo
2. Create request for commercial register
3. Create request for location
4. All pending at the same time
5. Admin can review and approve all together

### Use Case 2: Admin Wants to Clean Up Old Requests
**Scenario:** Admin wants to delete old processed requests

**Before:**
- Admin could delete any request including pending ones
- Risk of accidentally deleting pending requests

**After:**
- Admin must approve/reject pending requests first
- Can only delete approved/rejected requests
- Safer workflow

---

## 📝 Code Changes

### Vendor Controller
**File:** `app/Http/Controllers/Api/Dashboard/Vendor/UpdateRequest/ProfileUpdateRequestController.php`

**Removed:**
```php
// Check if vendor has a pending request
$pendingRequest = ProfileUpdateRequest::where('vendor_id', auth()->id())
    ->where('status', 'pending')
    ->first();

if ($pendingRequest) {
    return json(null, __('You already have a pending profile update request.'), 'fail', 400);
}
```

**Result:** Vendor can now create unlimited pending requests

### Admin Controller
**File:** `app/Http/Controllers/Api/Dashboard/Admin/User/ProfileUpdateRequestController.php`

**Added:**
```php
public function destroy($id)
{
    $profileUpdateRequest = ProfileUpdateRequest::findOrFail($id);

    // Admin cannot delete pending requests
    if ($profileUpdateRequest->status->value === 'pending') {
        return json(null, __('Cannot delete pending requests. Please approve or reject first.'), 'fail', 400);
    }

    // ... rest of delete logic
}
```

**Result:** Admin must approve/reject before deleting

---

## 🔍 Testing Scenarios

### Test 1: Vendor Creates Multiple Requests
```bash
# Create first request
POST /api/dashboard/vendor/profile-update-requests
{
  "logo": "media-id-1",
  "ar": {"name": "Name 1", "description": "Desc 1"},
  "en": {"name": "Name 1", "description": "Desc 1"}
}
✅ Success

# Create second request immediately
POST /api/dashboard/vendor/profile-update-requests
{
  "commercial_register_file": "media-id-2",
  "ar": {"name": "Name 2", "description": "Desc 2"},
  "en": {"name": "Name 2", "description": "Desc 2"}
}
✅ Success (no error about existing pending request)
```

### Test 2: Admin Tries to Delete Pending Request
```bash
# Try to delete pending request
DELETE /api/dashboard/admin/profile-update-requests/1
❌ Error: "Cannot delete pending requests. Please approve or reject first."
```

### Test 3: Admin Deletes Approved Request
```bash
# Approve request first
POST /api/dashboard/admin/profile-update-requests/1/approve
✅ Success

# Now delete
DELETE /api/dashboard/admin/profile-update-requests/1
✅ Success: "Profile update request deleted successfully."
```

### Test 4: Admin Deletes Rejected Request
```bash
# Reject request first
POST /api/dashboard/admin/profile-update-requests/1/reject
{
  "reason": "Invalid documents"
}
✅ Success

# Now delete
DELETE /api/dashboard/admin/profile-update-requests/1
✅ Success: "Profile update request deleted successfully."
```

---

## 📊 Status Flow

```
┌─────────────────────────────────────────────────────────┐
│                  VENDOR ACTIONS                         │
└─────────────────────────────────────────────────────────┘

Create Request → PENDING (can create unlimited)
                    ↓
Delete Request → ✅ Allowed (only pending)


┌─────────────────────────────────────────────────────────┐
│                  ADMIN ACTIONS                          │
└─────────────────────────────────────────────────────────┘

PENDING → Approve → APPROVED → Delete ✅ Allowed
       → Reject  → REJECTED → Delete ✅ Allowed
       → Delete  → ❌ NOT ALLOWED
```

---

## ✅ Summary

**What Changed:**
1. ✅ Removed restriction on vendor creating multiple pending requests
2. ✅ Added restriction on admin deleting pending requests

**Why:**
1. More flexibility for vendors to submit multiple updates
2. Safer workflow for admins (must process before deleting)

**Impact:**
- Vendors can work faster (no waiting for approval to submit next request)
- Admins have safer workflow (can't accidentally delete pending requests)
- Better audit trail (all requests must be processed before deletion)